Is Allow Copy + safe?
Allow Copy + is medium risk. A content script on allowcopyplus.pidevex.com, the dev's own site opened after install, relays a postMessage to the worker, which checks origin/ID then returns activation history: hostnames, counts/dates, an ID; sent in the install URL.
Who publishes itpidevex - 4 other listings from the same operator, none carrying a finding
pidevex - 4 other listings from the same operator, none carrying a finding
What this publisher told the store about itself, and the other listings that told it the same thing.
Same store account
4 other listings published from this account, 33k+ users between them, none of them carrying a finding.
AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.
Publishers can request a review.
Findings
Developer's Website Can Read Your Activation History via postMessage
A content script on allowcopyplus.pidevex.com, the dev's own site opened after install, relays a postMessage to the worker, which checks origin/ID then returns activation history: hostnames, counts/dates, an ID; sent in the install URL.
What actually happens
You visit the developer's own website, allowcopyplus.pidevex.com, including the walkthrough page the extension opens automatically right after installation.
A content script the extension injects on that site relays a postMessage to the service worker, which reads your activation history from storage and posts it back to the page.
The reply includes every hostname where you've turned the extension on or off, your on/off counts and their dates, and a persistent per-install ID, all readable by JavaScript running on the developer's page.
What the developer's page receives in the EXT_RESP_STAT reply
- Sites where extension was activatedgithub.com, docs.google.com, mail.example.com (illustrative — the real list reflects your own activation history)
Every hostname you've turned Allow Copy + on for is sent as a list, letting the page infer which sites you use it on.
- Activation/deactivation counts and dates{"activateCount":4,"deactivateCount":1,"lastActivateDate":"2026-07-02T09:14:00.000Z"} (illustrative — the real object reflects your own activation history)
How many times you've turned the extension on and off, plus the timestamps of your most recent activate and deactivate.
- Persistent install IDa1b2c3d4-5e6f-4a1b-9c2d-3e4f5a6b7c8d (illustrative — a real UUID generated at install)
A UUID generated once at install and never rotated, letting the site recognize your browser as the same visitor across separate site visits.
The code that does this
The postMessage bridge as shipped vs. annotated
Content script, annotated
974.[hash].js// Content script injected on https://allowcopyplus.pidevex.com/*window.addEventListener('message', async (event) => { // Only accepts requests whose page origin is the developer's own site... if (event.origin === new URL(WEB_SITE_URL).origin && event.data?.type === 'EXT_GET_STAT') { // ...then forwards whatever the page sent as the request body const request = { type: 'WS_GetStat', data: event.data }; chrome.runtime.sendMessage(request).then((response) => { if (response?.isSuccess) { // Posts the extension's reply straight back to the page window.postMessage({ type: 'EXT_RESP_STAT', stat: response.data.stat, extId: response.data.extId, created: new Date().toISOString(), }, new URL(WEB_SITE_URL).origin); } }); }});Service worker message handler, annotated
285.[hash].js// Service worker message handlercase 'WS_GetStat': { let result = { isSuccess: false }; // Gate: sender's page origin must be the developer's site, AND the // extId in the request must equal this install's own runtime ID. if (sender.origin === new URL(WEB_SITE_URL).origin && message.data?.extId === getExtId()) { await chrome.storage.sync.get().then((store) => { result = { isSuccess: true, data: { extId: getExtId(), created: new Date().toISOString(), stat: { stat: store[ACTIVATION_STAT_KEY], // activate/deactivate counts + dates inst: store[INSTANCE_KEY], // persistent per-install UUID domains: store[DOMAINS_KEY], // every hostname you've toggled the extension on }, }, }; }).catch(() => { result = { isSuccess: false }; }); } sendResponse(result); break;}Reproduce it yourself
Reproduces the postMessage handshake so you can see, in your own browser, exactly what activation data the extension discloses to this page.
- Allow Copy + installed
- Chrome DevTools
// allowcopyplus-stat-reveal.js// Run this in the DevTools console while visiting https://allowcopyplus.pidevex.com// with "Allow Copy +" installed. It reproduces the handshake the page's own// script performs, and logs whatever the extension discloses back to the page.// 1. Find the extension's runtime ID. The extension discloses this itself: it// opens https://allowcopyplus.pidevex.com/how-to-use?ext_id=<RUNTIME_ID> right// after install, so a script on this origin can read it from location.href on// that first visit. If you're not on that URL, grab RUNTIME_ID from// chrome://extensions (enable Developer mode, copy the ID) and paste it below.const RUNTIME_ID = new URLSearchParams(location.search).get('ext_id') || '<paste runtime id here>';// 2. Listen for the extension's reply before sending the request.window.addEventListener('message', (event) => { if (event.origin !== location.origin) return; if (event.data?.type !== 'EXT_RESP_STAT') return; console.log('Extension disclosed:', event.data);}, { once: true });// 3. Send the handshake the extension's own content script listens for.window.postMessage({ type: 'EXT_GET_STAT', extId: RUNTIME_ID }, location.origin);- 1Paste into the DevTools console on https://allowcopyplus.pidevex.com with Allow Copy + installed, then press Enter.
Where this reply is readable
- allowcopyplus.pidevex.com
The developer's own site (PiDevEx/Allow Copy +), opened after install with the runtime ID in the URL, letting it request your activation history via postMessage later.